https://project.mdnd-it.cc/work_packages/94
This commit is contained in:
2025-08-23 04:25:28 +02:00
parent 725516ad6c
commit 19cfa031d0
25823 changed files with 1095587 additions and 2801760 deletions
+3 -3
View File
@@ -358,17 +358,17 @@ You can use this as standalone middleware with `app.use(helmet.referrerPolicy())
Default:
```http
Strict-Transport-Security: max-age=15552000; includeSubDomains
Strict-Transport-Security: max-age=31536000; includeSubDomains
```
The `Strict-Transport-Security` header tells browsers to prefer HTTPS instead of insecure HTTP. See [the documentation on MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security) for more.
```js
// Sets "Strict-Transport-Security: max-age=15552000; includeSubDomains"
// Sets "Strict-Transport-Security: max-age=31536000; includeSubDomains"
app.use(helmet());
```
`maxAge` is the number of seconds browsers should remember to prefer HTTPS. If passed a non-integer, the value is rounded down. It defaults to `15552000`, which is 180 days.
`maxAge` is the number of seconds browsers should remember to prefer HTTPS. If passed a non-integer, the value is rounded down. It defaults to 365 days.
`includeSubDomains` is a boolean which dictates whether to include the `includeSubDomains` directive, which makes this policy extend to subdomains. It defaults to `true`.